@everystack/server 0.4.11 → 0.4.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.11",
+  "version": "0.4.12",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -159,9 +159,9 @@
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/cli": "0.4.25",
+    "@everystack/pg-tools": "0.4.1",
     "@everystack/auth": "0.4.0",
-    "@everystack/pg-tools": "0.4.0"
+    "@everystack/cli": "0.4.28"
   },
   "scripts": {
     "test": "jest",

package/src/db.ts

@@ -110,6 +110,25 @@ export function getAdminDatabaseUrl(): string | null {
   return null;
 }
 
+/**
+ * The OPERATOR connection the privileged write lanes run on: the provisioned admin
+ * (migrator/owner) credential when present, else the linked SST Postgres master. Never the
+ * least-privilege authenticator (`DATABASE_URL`) — these lanes run DDL the authenticator
+ * cannot. Reports which source won so the caller can log the venue (not the credential).
+ *
+ * This is the resolution the `--direct` write lanes and `db:swap --stage` share (the
+ * stage-write-lanes foundation): the ops action returns this URL to an IAM-gated caller,
+ * which holds it in process memory and never prints it. Returns null when no operator
+ * connection is configured at all.
+ */
+export function getOperatorDatabaseUrl(): { url: string; source: 'admin' | 'master' } | null {
+  const admin = getAdminDatabaseUrl();
+  if (admin) return { url: admin, source: 'admin' };
+  const master = getMasterDatabaseUrl();
+  if (master) return { url: master, source: 'master' };
+  return null;
+}
+
 export function getJwtSecret(): Uint8Array {
   // PascalCase Secret (SST_RESOURCE_JwtSecret → { value })
   const pascal = sstLink('JwtSecret')?.value as string | undefined;

package/src/plugin.ts

@@ -625,6 +625,25 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       return { host: db.host, port: db.port, database: db.database, username: db.username, password: db.password };
     };
 
+    // --- db:operator-url ---
+    // The stage-write-lanes foundation (brick 1): resolve the OPERATOR connection
+    // (admin/migrator, else the linked master — never the least-privilege authenticator)
+    // and return it to the IAM-gated caller. The CLI's `--direct` write verbs and
+    // `db:swap --stage` invoke this, hold the URL in process memory, execute CLI-side with
+    // an unbounded clock, and never print it. The URL travels only in the Lambda invoke
+    // response — the same in-process channel db:psql uses for its components.
+    actions['db:operator-url'] = async () => {
+      const { getOperatorDatabaseUrl } = await import('./db');
+      const operator = getOperatorDatabaseUrl();
+      if (!operator) {
+        return {
+          error:
+            'no operator connection available — provision an admin credential (ADMIN_DATABASE_URL / AdminDatabaseUrl) or link an sst.aws.Postgres component for the master fallback.',
+        };
+      }
+      return { url: operator.url, source: operator.source };
+    };
+
     // --- db:query ---
     actions['db:query'] = async (payload, _ctx) => {
       const { sql: querySql } = payload as { sql: string };
@@ -1015,6 +1034,61 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       }
     };
 
+    // --- db:backfill — the one-shot data-job lane, stage-side (stage-write-lanes brick 4) ---
+    // db:backfill was direct-connection only: the sanctioned agent path for a committed,
+    // content-addressed, idempotent data job ended at "paste SQL into psql". This runs the
+    // same backfill core on the operator connection: the CLI ships the *.sql files, this plans
+    // (by content identity, against everystack.backfill_log), and under apply runs the pending
+    // jobs in order and records each. A least-privileged operator never holds a URL for a small
+    // data job; the --direct lane (CLI-side) is the escape for jobs too big for the 900s clock.
+    actions['db:backfill'] = async (payload, _ctx) => {
+      const p = (payload ?? {}) as {
+        files?: { file: string; sql: string }[];
+        apply?: boolean;
+        markApplied?: string;
+        actor?: string | null;
+        gitRef?: string | null;
+      };
+      try {
+        const {
+          planBackfills, readBackfillLog, executeBackfills, markBackfillApplied,
+        } = await import('@everystack/cli/backfill');
+        const { sql } = await import('drizzle-orm');
+        const runner = async (query: string): Promise<any[]> => {
+          const result: any = await opsDb.execute(sql.raw(query));
+          return Array.isArray(result) ? result : result?.rows ?? [];
+        };
+        const files = p.files ?? [];
+        const opts = { actor: p.actor ?? null, gitRef: p.gitRef ?? null };
+
+        // Adopt hatch: record a file as applied WITHOUT running it.
+        if (p.markApplied) {
+          const file = files.find((f) => f.file.endsWith(`/${p.markApplied}`) || f.file === p.markApplied);
+          if (!file) return { error: `--mark-applied names a file not shipped: ${p.markApplied}` };
+          const identity = await markBackfillApplied(runner, file as any, opts);
+          return { markedApplied: file.file, identity };
+        }
+
+        const plan = await (async () => planBackfills(files as any, await readBackfillLog(runner)))();
+        const planOut = {
+          applied: plan.applied,
+          pending: plan.pending.map(({ sql: _sql, ...rest }: any) => rest),
+          blocked: plan.blocked,
+        };
+        if (!p.apply) return { plan: planOut, applied: false };
+
+        const result = await executeBackfills(runner, plan, opts);
+        return {
+          plan: planOut,
+          applied: true,
+          ran: result.ran,
+          failed: result.failed ?? null,
+        };
+      } catch (err: any) {
+        return { error: err?.message || String(err) };
+      }
+    };
+
     // --- db:refresh — the credential-free DATA lane's refresh half (the reconcile-lane twin) ---
     // db:reconcile deploys the derived DEFINITION but no-ops on an unchanged def, so a pure
     // DATA-changed matview refresh had no credential-free path. This runs the refresh HERE on